IBM CVE-2025-14917

The CVSS v3.1 score of 6.7 reflects a medium-to-high severity issue with important risk factors: local attack vector (AV:L) requires the attacker to have some level of system access, high privilege requirement (PR:H) limits the threat actor pool to administrators or privileged accounts, and no user interaction needed (UI:N) makes exploitation straightforward once privileges are obtained. The impact is significant—high confidentiality, integrity, and availability impact (C:H/I:H/A:H)—but confined to the affected system (S:U). While EPSS data is not provided in this intelligence, the combination of privilege requirement and local attack vector suggests real-world exploitation risk is moderate for typical enterprise deployments where administrative access is tightly controlled. This is not a remote code execution vulnerability and does not enable unauthenticated access; however, it is a privilege abuse or misconfiguration weakness that could be weaponized by insider threats or compromised administrative accounts. The availability of a vendor patch and lack of public exploit code further reduce immediate urgency, but the vulnerability should still be treated as a priority for systems with high-privilege user bases.

An attacker with compromised administrative credentials or insider access could log into the WebSphere Liberty administrative console and exploit the weak security settings enforcement to modify security policies, disable authentication for specific applications, or escalate their privileges to grant themselves additional administrative roles. Because the attack vector is local (AV:L) and requires high privileges (PR:H), the typical scenario involves a disgruntled administrator, a compromised service account with admin rights, or an attacker who has already gained initial access to the system and seeks to entrench their position by weakening security controls. No public proof-of-concept or active exploitation has been reported as of the intelligence collection date.